github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Bluetooth: L2CAP: Reject signalling responses in invalid states

Browse Source 
A peer can send configuration messages while an
incoming channel is in BT_CONNECT2, before the
security or deferred accept gate has completed. A
configuration response can then promote the channel
to BT_CONNECTED. Configuration responses can also
act on channels that are closing, and a late connection
response can move a disconnecting channel back to
BT_CONFIG.

Accept connection responses only while waiting in
BT_CONNECT. Answer configuration requests in
BT_CONNECT2, but defer our own request until
BT_CONFIG so configuration cannot complete before
the gate. Ignore configuration responses outside
BT_CONFIG and BT_CONNECTED, and only complete
configuration in BT_CONFIG.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Siwei Zhang 2026-10-13 11:36:34 -04:00 committed by Luiz Augusto von Dentz
parent c1398cf11b
commit 6320736af7
1 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
net/bluetooth/l2cap_core.c
View File

@ -4442,6 +4442,10 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
lockdep_assert_held(&chan->conn->lock);
/* Ignore a late response after the channel has left BT_CONNECT. */
if (chan->state != BT_CONNECT)
goto done;
switch (result) {
case L2CAP_CR_SUCCESS:
if (__l2cap_get_chan_by_dcid(conn, dcid)) {
@ -4471,6 +4475,7 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
break;
}
done:
l2cap_chan_unlock(chan);
l2cap_chan_put(chan);
@ -4608,7 +4613,13 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
goto unlock;
}
if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
/* A channel in BT_CONNECT2 has not passed security or userspace
* accept yet. Answer the peer's request, but hold our own until
* the channel reaches BT_CONFIG: the CONNECT2 -> CONFIG sites send
* it. Connected channels may also need to reconfigure.
*/
if ((chan->state == BT_CONFIG || chan->state == BT_CONNECTED) &&
!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
u8 buf[64];
l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
@ -4661,6 +4672,10 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn,
lockdep_assert_held(&chan->conn->lock);
/* Connected channels may also receive reconfiguration responses. */
if (chan->state != BT_CONFIG && chan->state != BT_CONNECTED)
goto done;
switch (result) {
case L2CAP_CONF_SUCCESS:
l2cap_conf_rfc_get(chan, rsp->data, len);
@ -4728,6 +4743,9 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn,
if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
set_default_fcs(chan);
if (chan->state != BT_CONFIG)
goto done;
if (chan->mode == L2CAP_MODE_ERTM ||
chan->mode == L2CAP_MODE_STREAMING)
err = l2cap_ertm_init(chan);